jeffersongoncalves/laravel-gtm
The package is licensed, documented, and has a small but active two-person contributor base. Its repository is current and includes Dependabot and a security policy. Review the high-confidence template-injection finding in the changelog workflow before relying on automated releases.
78%
Total Score
83
100
100
75
Health Score Breakdown
A post-autoload-dump install-time script is present, adding execution during dependency installation. The signal provides no evidence that the script is unsafe, so this is a limited supply-chain consideration rather than a severe risk.
The repository is owned by the same individual namespace as the package, so the maintainer context is consistent, though it does not provide organization-level handoff capacity.
All four workflows were analyzed, all 15 action references are pinned, and no untrusted checkout or script-injection paths were found. However, the auditor reported one high-confidence template-injection finding in update-changelog.yml, which warrants review even though template injection alone is a hygiene concern.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Jefferson Gonçalves |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 laravel/framework Version ^12.61.1|^13.12.0 | — | — |
spatie/laravel-settings Version ^3.0 | — | — |
spatie/laravel-package-tools Version ^1.14.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.